This policy explains what personal data we process when we run Odepisuj, why we need it, and how long we keep it. Odepisuj is a shared inbox for Instagram messages and comments. It is available at app.odepisuj.cz.
1. Data controller
The controller is Noeveris s.r.o., company ID (IČO) 23876247, Příčná 1892/4, 110 00 Praha 1, Czech Republic. Write to info@odepisuj.cz with any privacy question or deletion request.
2. What data we process
- Instagram contact profile: username, name and profile picture. We receive them from Meta when a contact messages a connected account or comments on its posts.
- Messages and attachments sent by contacts, and the replies sent from the app.
- Comments on posts of a connected account, and replies to them.
- Email addresses and phone numbers that a contact writes in a conversation and that the app stores on the contact profile.
- Access tokens of connected Instagram accounts. They are stored encrypted and never displayed.
- Data about app users: email address, hashed password and sign-in records.
3. Why we process it
We use the data for only three purposes: running the shared inbox where a team answers messages and comments, sending automated replies based on rules you set up, and replies written by artificial intelligence if you turn them on for a connected account. The legal bases are performance of the contract with the account owner and our legitimate interest in running a secure service.
4. Retention
| Data | Retention and deletion |
|---|---|
| Raw records of received events | 3 days, discarded ones 1 day. Meta retries delivery for up to 36 hours. |
| Error records with queue message content | Content is cleared after 30 days. These records never contain message text, only codes and identifiers. |
| Outgoing message queue | Message content is cleared after 30 days and the record is deleted after 90 days. |
| Sessions, invitations and sign-in records | 1 day after expiry. |
| Messages and attachments | Set per workspace. By default there is no automatic deletion, so data stays until the contact or the account is deleted. The owner can turn on deletion after a chosen number of months. |
| Audit log and daily metrics | Audit log 12 months, without message text. Daily metrics 13 months. |
| Instagram account access tokens | Encrypted (AES-GCM-256). Irreversibly deleted when the account is disconnected or when permission is revoked. |
5. Processors and recipients
We do not sell data. We rely on these processors to run the service:
- Meta Platforms is both the source and the destination of messages. We receive incoming messages and comments from Meta and send replies through it.
- Anthropic, PBC provides the language model behind AI replies. Conversation text reaches it only for accounts where the owner has enabled AI replies. Anthropic is bound by contract not to use this data for training.
- Cloudflare, Inc. runs the infrastructure the app is hosted on: compute, database and attachment storage.
6. Model training
We do not use data from the app to train any model. Nor may our processor for AI replies, Anthropic, whose contract forbids it (see section 5).
7. Cookies
We set one cookie: the sign-in session of an app user. It is required to sign in. We use no tracking or advertising cookies, and these legal pages run no scripts.
8. Your rights
You have the right to access your data, to have it corrected or erased, to object to processing and to restrict it. If you believe we handle your data in breach of the rules, you can lodge a complaint with the Czech Office for Personal Data Protection (ÚOOÚ).
9. Requesting deletion
You can ask for your data to be deleted at any time. The steps, including how to follow the status of a request, are on the Data deletion page. You can also email info@odepisuj.cz.
Operator: Noeveris s.r.o., company ID (IČO) 238 76 247, not a VAT payer, Příčná 1892/4, Nové Město, 110 00 Praha 1, Czech Republic. Registered in the Commercial Register kept by the Municipal Court in Prague, section C, file 432748.
Last updated:
Contact: info@odepisuj.cz · +420 704 096 969